CVE-2024-24824

CVE-2024-24824 affects Graylog server prior to 5.1.11 and 5.2.4. The issue arises when an authenticated user with appropriate permissions sends a HTTP PUT to the endpoint "/api/system/cluster_config/", allowing loading and instantiation of arbitrary classes by using fully-qualified class names as...

CVE-2024-24824: Improper Access Control

Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/clusterconfig/ endpoint. Graylog's cluster config system uses fully qualified class...

Graylog Security Vulnerability

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing, and analyzing logs in real time, among other things. A security vulnerability exists in Graylog versions 2.0.0 through 5.2.3, which stems from a security vulnerability in endpoint...